A user might have noticed that several IPs are being blocked in Kerio Operator including some of the trusted IPs, and one needs to manually remove them from the blocked list.
This is working as expected based on the security settings, and one approach to lessen the number of IPs being blocked is to tweak the configuration with the number of unsuccessful SIP logins and the time period. For further instructions on how to manage these settings as well as how to identify malicious behavior, refer to Configuring Protection Against Password Guesses.
Note that by design, the security rule will trigger even if the IPs are defined on the list of trusted ones (IP Address Groups). This is especially relevant when there are people joining with Mobile Phones or computers outside of the network.